the product object
A plant controller. Five parts. Those five parts are PRAUS.
You do not prompt it and you do not build agents on it. You commission a unit, point it at a plant, arm the theaters it may hold, and it runs that plant inside a hard envelope — code that refuses the actuation.
Plant
The live systems it is allowed to see and touch. Named. Bounded. Nothing outside the list exists to it.
Setpoint
Desired state: healthy, least-privilege, this version, this blast radius, this budget.
Envelope
Hard limits the model cannot cross — the same idea as flight-envelope protection. Not a system prompt. Not a policy PDF. Code that refuses the actuation.
Actuators
A closed, reversible library: rollback, isolate, drain, rotate, freeze identity, fail over, rebalance, revert the last apply. No open-ended shell.
Black box
Every sense → decide → act → verify cycle is a signed evidence bundle. The tape survives the horse.
and what it is not
Not a harness, SDK, multi-agent OS, or sandbox for someone else's agent. Not a copilot in the IDE. Not a SIEM with a summarize button. Not a runbook runner with an LLM glued on. Not the stables — the horse.
theaters · what a unit may hold
Five certified jobs. Each with its own maneuvers, bridle slice, and promotion path.
Release
Canary, pause, abort, rollback, pin. PRAUS owns whether a merge stays live.
Identity
Disable key, revoke session, shrink role, expire grant. Never attach admin.
Capacity
Scale, hibernate, right-size, schedule. Never below min-available, never delete data.
Continuity
Drain, cordon, fail over, rebalance, shift traffic, restart the stuck job.
Exposure
Close, isolate, rotate, unpublish. Unwind required or it does not ship.
A unit with only Capacity is a real product. A unit with all five is cavalry in one theater of war — still not a harness.
v1 · one account, one cluster, one idp
An envelope that cannot be talked out of.
- denyCannot delete data stores
- denyCannot widen its own IAM
- denyCannot act outside named resources
- denyEvery actuation has an unwind
- denyRate cap on moves per hour
- denyFreeze to last known good if verify fails
Do not ship "autonomous enterprise." Ship one unit on one theater, and make every move reversible. If it cannot do the loops reversibly, it is not PRAUS yet.
first autonomous loops
Restart / drain
Node cordoned and workload moved; unwind returns the node to the pool.
Release rollback
Previous known-good release restored; unwind re-promotes.
Session revoke
Sessions for a principal invalidated; unwind re-enables sign-in.
Key disable
Credential disabled, not deleted; unwind re-enables.
Security-group isolate
Ingress and egress narrowed to nothing; unwind restores the rules.
the tape
A record a CISO will sign, for every cycle.
evidence/9f2c-4471-b0e1
plant cluster/edge-1
sense p99 latency 2.41s (setpoint <= 0.60s)
saturation 0.93 on node-7
decide proposal: drain node-7
envelope GRANTED (named resource · unwind present · 2/6 moves this hour)
act drain node-7 · 14 pods rescheduled
verify p99 0.48s · replicas 14/14 · no other resource touched
unwind uncordon node-7 (available 24h)
signature ed25519:8f31…c02a · appended 02:41:07Z